[escher-m]

Problem

GET /v1/settings returned every notification secret in full, and the Settings page filled them into its form:

• Slack/Discord and Teams webhook URLs were readable on screen. Anyone who has the URL can post into that channel.
• The SMTP password, Slack signing secret and SIEM token were shown as dots, but the real value was in the page and in the network response.
• The Telegram bot token was in the API response.

Only the Anthropic AI key was already masked.

Change

• Server (public_settings): SECRET_SETTINGS are removed from the response. Each comes back as <name>_set and <name>_hint. The hint is the last 4 characters, plus the host for a URL (for example hooks.slack.com/…wxyz). PUT works as before: a value replaces the secret, "" removes it, and leaving it out keeps it. The gateway still uses the real values to send.
• Dashboard: secret fields load empty and show "Saved (…hint). Paste a new one to replace it." Saving with a field empty keeps the saved secret. Each saved secret gets a Remove button, which replaces the old "leave empty to turn off". The channel tiles use *_set.
• The ntfy topic stays visible on purpose: people need to read it to subscribe on their phone.

Testing

• New test test_settings_never_send_secrets_back: secrets are missing from the GET and PUT responses, the hints are right, saving other settings keeps the secrets, and "" removes one.
• Full suite: 1615 passed, 5 skipped.
• End to end in Chrome against a local gateway:
  • With secrets saved over the API, the page HTML contains none of them and the Slack tile shows On.
  • Typed a Teams webhook and clicked Save: it was stored, the SMTP password left empty was kept, and the field went back to the masked placeholder.
  • Clicked Remove on Slack: it was cleared in the DB and the tile changed to Off.
  • Saved the SIEM form with the token empty: the token was kept.
  • No console errors.

🤖 Generated with Claude Code

[gitguardian]

⚠️ GitGuardian has uncovered 1 secret following the scan of your pull request.

Please consider investigating the findings and remediating the incidents. Failure to do so may lead to compromising the associated services or software components.

🔎 Detected hardcoded secret in your pull request

GitGuardian id	GitGuardian status	Secret	Commit	Filename
40037188	Triggered	Generic Password	ca38729	tests/test_server.py	View secret

🛠 Guidelines to remediate hardcoded secrets

1. Understand the implications of revoking this secret by investigating where it is used in your code.
2. Replace and store your secret safely. Learn here the best practices.
3. Revoke and rotate this secret.
4. If possible, rewrite git history. Rewriting git history is not a trivial act. You might completely break other contributing developers' workflow and you risk accidentally deleting legitimate data.

To avoid such incidents in the future consider

• following these best practices for managing and storing secrets including API keys and other credentials
• install secret detection on pre-commit to catch secret before it leaves your machine and ease remediation.

---

^{🦉 GitGuardian detects secrets in your source code to help developers and security teams secure the modern development process. You are seeing this because you or someone else with access to this repository has authorized GitGuardian to scan your pull request.}